4 ms·

Every database that contains your PII increases your exposure to a breach and likelihood of having to deal with it. It's not the sudafed use that makes it a tar

Every database that contains your PII increases your exposure to a breach and likelihood of having to deal with it. It's not the sudafed use that makes it a target: it's the driver's license.

tptacek 3y ago
Right, but this particular database presumably doesn't have anything especially sensitive in it, apart from your Sudafed consumption. I don't mean to dismiss that point, it's a valid point, I'm just considering it closely.
- fluidcruft 3y ago
  Anything a government uses to uniquely identify and track individuals (i.e. driver's license) is the target.
  - tptacek 3y ago
    Until very recently, drivers license numbers were effectively public in a lot of states (they're deterministically generated from public information).
    - fluidcruft 3y ago
      Hey, that's pretty cool. I suppose I now know Ron DeSantis's drivers license number up to the last digit. And the soundex algorithm is cool (using fuzzy lookup in a list that way to get close/vague matches is novel to me and might be useful). I had heard of soundex but didn't know how it worked until now. Thanks for the TILs! https://stevemorse.org/dl/dl.html https://stevemorse.org/dl/dl.html http://www.highprogrammer.com/alan/numbers/index.html http://www.highprogrammer.com/alan/numbers/index.html
- CamperBob2 3y ago
  It's none of their business. Simple as that.
- lazide 3y ago
  Sudafed usage, probably a copy of the drivers license, your address, any phone number you give them, and how often you buy a drug the DEA considers a precursor to something really terrible. Usually no one even looks at it (so why have it even?!?), but when they do it’s a potential intro to a full on Brazil situation. Luckily the whole thing is generally considered a waste of time, so usually nothing comes of it. But why make yourself a target if you can avoid it?
  - tptacek 3y ago
    Well, it seems pretty obvious why they have it: so they can match purchases of Sudafed at different retail outlets at different points in time. And it's obvious why they want to do that: because there really was a huge epidemic of people making straw purchases of Sudafed to feed large numbers of low-volume amateur meth labs. In the years after this policy was put into place, there were news stories about how effective it had been in eliminating backyard meth production. You don't see those stories anymore. I suggest, with weak confidence, that the reason you don't isn't that backyard meth has roared back, but rather that it's so decisively not a part of the equation anymore that stats about it don't really matter. Meth comes from overseas now, not from backyards. That doesn't solve the meth consumption problem, but it does eliminate one significant meth externality.
    - lazide 3y ago
      I love how we're still stuck not being able to buy Sudafed normally though. :(
      - tptacek 3y ago
        You mean, by walking into the drug store and asking for it?
        lazide 3y ago
        By literally going to the aisle with the decongestants, taking a pack, and paying for it like every other thing I would be buying. Like every other OTC drug. Without having to give ID, find a pharmacist, etc. I remember those days. They're long gone, obviously.

Every database that contains your PII increases your exposure to a breach and likelihood of having to deal with it. It's not the sudafed use that makes it a target: it's the driver's license.

tptacek 3y ago

Right, but this particular database presumably doesn't have anything especially sensitive in it, apart from your Sudafed consumption. I don't mean to dismiss that point, it's a valid point, I'm just considering it closely.

fluidcruft 3y ago
Anything a government uses to uniquely identify and track individuals (i.e. driver's license) is the target.
- tptacek 3y ago
  Until very recently, drivers license numbers were effectively public in a lot of states (they're deterministically generated from public information).
  - fluidcruft 3y ago
    Hey, that's pretty cool. I suppose I now know Ron DeSantis's drivers license number up to the last digit. And the soundex algorithm is cool (using fuzzy lookup in a list that way to get close/vague matches is novel to me and might be useful). I had heard of soundex but didn't know how it worked until now. Thanks for the TILs! https://stevemorse.org/dl/dl.html https://stevemorse.org/dl/dl.html http://www.highprogrammer.com/alan/numbers/index.html http://www.highprogrammer.com/alan/numbers/index.html
CamperBob2 3y ago
It's none of their business. Simple as that.
lazide 3y ago
Sudafed usage, probably a copy of the drivers license, your address, any phone number you give them, and how often you buy a drug the DEA considers a precursor to something really terrible. Usually no one even looks at it (so why have it even?!?), but when they do it’s a potential intro to a full on Brazil situation. Luckily the whole thing is generally considered a waste of time, so usually nothing comes of it. But why make yourself a target if you can avoid it?
- tptacek 3y ago
  Well, it seems pretty obvious why they have it: so they can match purchases of Sudafed at different retail outlets at different points in time. And it's obvious why they want to do that: because there really was a huge epidemic of people making straw purchases of Sudafed to feed large numbers of low-volume amateur meth labs. In the years after this policy was put into place, there were news stories about how effective it had been in eliminating backyard meth production. You don't see those stories anymore. I suggest, with weak confidence, that the reason you don't isn't that backyard meth has roared back, but rather that it's so decisively not a part of the equation anymore that stats about it don't really matter. Meth comes from overseas now, not from backyards. That doesn't solve the meth consumption problem, but it does eliminate one significant meth externality.
  - lazide 3y ago
    I love how we're still stuck not being able to buy Sudafed normally though. :(
    - tptacek 3y ago
      You mean, by walking into the drug store and asking for it?
      - lazide 3y ago
        By literally going to the aisle with the decongestants, taking a pack, and paying for it like every other thing I would be buying. Like every other OTC drug. Without having to give ID, find a pharmacist, etc. I remember those days. They're long gone, obviously.